package/x11r7/xlib_libXfont2: bump version to 2.0.2

PATCH New Bernd Kuhls 3 participants 6 messages Oct 14, 2017 – Oct 15, 2017

lore

Share & tools

lore

Bernd Kuhls

author

2017-10-14 11:37 UTC #0 lore raw

PATCH 1/4 package/x11r7/xlib_libXfont2: bump version to 2.0.2

Removed patches applied upstream, added all upstream hashes.

Signed-off-by Bernd Kuhls <[email protected]>

---
 ...nd-of-string-in-PatternMatch-CVE-2017-137.patch | 34 --------------
 ...rties-Check-string-boundaries-CVE-2017-13.patch | 52 ----------------------
 package/x11r7/xlib_libXfont2/xlib_libXfont2.hash   |  7 ++-
 package/x11r7/xlib_libXfont2/xlib_libXfont2.mk     |  2 +-
 4 files changed, 6 insertions(+), 89 deletions(-)
 delete mode 100644 package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
 delete mode 100644 package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch

package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch deleted +0 ~~-34~~

deleted file mode 100644
index 3795179af1..0000000000
@@ -1,34 +0,0 @@
-From d1e670a4a8704b8708e493ab6155589bcd570608 Mon Sep 17 00:00:00 2001
-From: Michal Srb <[email protected]>
-Date: Thu, 20 Jul 2017 13:38:53 +0200
-Subject: [PATCH] Check for end of string in PatternMatch (CVE-2017-13720)
-
-If a pattern contains '?' character, any character in the string is skipped,
-even if it is '\0'. The rest of the matching then reads invalid memory.
-
-Reviewed-by: Peter Hutterer <[email protected]>
-Signed-off-by: Julien Cristau <[email protected]>
-Signed-off-by: Peter Korsgaard <[email protected]>
----
- src/fontfile/fontdir.c | 4 +++-
- 1 file changed, 3 insertions(+), 1 deletion(-)
-
-diff --git a/src/fontfile/fontdir.c b/src/fontfile/fontdir.c
-index 4ce2473..996b7d1 100644
---- a/src/fontfile/fontdir.c
-+++ b/src/fontfile/fontdir.c
-@@ -400,8 +400,10 @@ PatternMatch(char *pat, int patdashes, char *string, int stringdashes)
- 		}
- 	    }
- 	case '?':
--	    if (*string++ == XK_minus)
-+	    if ((t = *string++) == XK_minus)
- 		stringdashes--;
-+	    if (!t)
-+		return 0;
- 	    break;
- 	case '\0':
- 	    return (*string == '\0');
--- 
-2.11.0
-

package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch deleted +0 ~~-52~~

52 lines not on this page · raw message

package/x11r7/xlib_libXfont2/xlib_libXfont2.hash +5 -2

index 81a3c9f1ea..3e763b268f 100644
@@ -1,2 +1,5 @@
-# From https://lists.x.org/archives/xorg-announce/2015-December/002663.html
-sha256 e9fbbb475ddd171b3a6a54b989cbade1f6f874fc35d505ebc5be426bc6e4db7e  libXfont2-2.0.1.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002813.html
+md5 d39e6446e46f939486d1a8b856e8b67b  libXfont2-2.0.2.tar.bz2
+sha1 d5117914a026b3fd47123cb1c2a22daaae3b63e4  libXfont2-2.0.2.tar.bz2
+sha256 94088d3b87f7d42c7116d9adaad155859e93330c6e47f5989f2de600b9a6c111  libXfont2-2.0.2.tar.bz2
+sha512 d62b0c3d663a2c668796cca8c6c2a90f83feeae1253b7d946668d33502cd8099c963285b88db4f745efb0d4ff783c118eb3d84cb8e6e1724586e1ef2be23e593  libXfont2-2.0.2.tar.bz2

package/x11r7/xlib_libXfont2/xlib_libXfont2.mk +1 -1

index fef1e68323..696c605a36 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XLIB_LIBXFONT2_VERSION = 2.0.1
+XLIB_LIBXFONT2_VERSION = 2.0.2
 XLIB_LIBXFONT2_SOURCE = libXfont2-$(XLIB_LIBXFONT2_VERSION).tar.bz2
 XLIB_LIBXFONT2_SITE = http://xorg.freedesktop.org/releases/individual/lib
 XLIB_LIBXFONT2_LICENSE = MIT

Signature · 1 line

2.11.0

Bernd Kuhls

author

2017-10-14 11:37 UTC #1 lore raw

PATCH 2/4 package/x11r7/xlib_libXres: bump version to 1.2.0

Added all hashes provided by upstream.

Signed-off-by Bernd Kuhls <[email protected]>

---
 package/x11r7/xlib_libXres/xlib_libXres.hash | 7 +++++--
 package/x11r7/xlib_libXres/xlib_libXres.mk   | 2 +-
 2 files changed, 6 insertions(+), 3 deletions(-)

package/x11r7/xlib_libXres/xlib_libXres.hash +5 -2

index 063df8e954..12a03518af 100644
@@ -1,2 +1,5 @@
-# From http://lists.x.org/archives/xorg-announce/2013-May/002233.html
-sha256	26899054aa87f81b17becc68e8645b240f140464cf90c42616ebb263ec5fa0e5	libXres-1.0.7.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002812.html
+md5 5d6d443d1abc8e1f6fc1c57fb27729bb  libXres-1.2.0.tar.bz2
+sha1 b6996ab05460a3b7311f02da23ddf117a5442fd9  libXres-1.2.0.tar.bz2
+sha256 ff75c1643488e64a7cfbced27486f0f944801319c84c18d3bd3da6bf28c812d4  libXres-1.2.0.tar.bz2
+sha512 8eb5a36b1f030eb4e27e676cc4befcc073da66a7bce2b39089314e1facb629d13b087bb53ca2c95fe5291857da7ff9f80c6ab28fb3e245eeb9e0344937900172  libXres-1.2.0.tar.bz2

package/x11r7/xlib_libXres/xlib_libXres.mk +1 -1

index 853f54205e..0075e8f60b 100644
@@ -4,7 +4,7 @@
 #
 ################################################################################
 
-XLIB_LIBXRES_VERSION = 1.0.7
+XLIB_LIBXRES_VERSION = 1.2.0
 XLIB_LIBXRES_SOURCE = libXres-$(XLIB_LIBXRES_VERSION).tar.bz2
 XLIB_LIBXRES_SITE = http://xorg.freedesktop.org/releases/individual/lib
 XLIB_LIBXRES_LICENSE = MIT

Signature · 1 line

2.11.0

Bernd Kuhls

author

2017-10-14 11:37 UTC #2 lore raw

PATCH 3/4 package/libdrm: bump version to 2.4.84

In reply to Bernd Kuhls

Changed _SITE to https.

Signed-off-by Bernd Kuhls <[email protected]>

---
 package/libdrm/libdrm.hash | 10 +++++-----
 package/libdrm/libdrm.mk   |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

package/libdrm/libdrm.hash +5 -5

index 704bf1b389..be24658b41 100644
@@ -1,5 +1,5 @@
-# From https://lists.freedesktop.org/archives/dri-devel/2017-August/151077.html
-md5 23800953ed7564988872e1e8c61fde31  libdrm-2.4.83.tar.bz2
-sha1 f78d392684d6e482e8c0a85d355619ac64c4ad6a  libdrm-2.4.83.tar.bz2
-sha256 03a52669da60ead62548a35bc430aafb6c2d8dd21ec9dba3a90f96eff5fe36d6  libdrm-2.4.83.tar.bz2
-sha512 8f894ff61939bca03ac857506a84bbbcbe2367e60c91a0f2388bfce5ae81e12ba2f96fe1c962416cf9e2d25ef04b98b5437c7015497789561311a72607b3bfcb  libdrm-2.4.83.tar.bz2
+# From https://lists.freedesktop.org/archives/dri-devel/2017-October/154645.html
+md5 35b9544bc2ad864acd1abaa1a2b99092  libdrm-2.4.84.tar.bz2
+sha1 3a8835aaef89648757593f00008de9eff95990dd  libdrm-2.4.84.tar.bz2
+sha256 7ae9c24d91139ac9a2cdee06fe46dbe1c401a1eda1c0bd2a6d1ecf72f479e0aa  libdrm-2.4.84.tar.bz2
+sha512 860ebc5fa934edee97e9e7e13aaa2f2e70a68b946f4f3893cd7f93b8296c10b3cd4ce4c23b1676eefe375286e6e2292b96e917d7976f65c61da3fa661e5e641a  libdrm-2.4.84.tar.bz2

package/libdrm/libdrm.mk +2 -2

index e4d3e3947b..da100b853b 100644
@@ -4,9 +4,9 @@
 #
 ################################################################################
 
-LIBDRM_VERSION = 2.4.83
+LIBDRM_VERSION = 2.4.84
 LIBDRM_SOURCE = libdrm-$(LIBDRM_VERSION).tar.bz2
-LIBDRM_SITE = http://dri.freedesktop.org/libdrm
+LIBDRM_SITE = https://dri.freedesktop.org/libdrm
 LIBDRM_LICENSE = MIT
 LIBDRM_INSTALL_STAGING = YES
 LIBDRM_DEPENDENCIES = \

Signature · 1 line

2.11.0

Bernd Kuhls

author

2017-10-14 11:37 UTC #3 lore raw

PATCH 4/4 package/x11r7/xserver_xorg-server: security bump version to 1.19.5

In reply to Bernd Kuhls

Fixes

xfixes: unvalidated lengths (CVE-2017-12183)

Xi: fix wrong extra length check in ProcXIChangeHierarchy
(CVE-2017-12178)

dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
(CVE-2017-12177)

Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)

Signed-off-by Bernd Kuhls <[email protected]>

---
 .../{1.19.4 => 1.19.5}/0001-modesettings-needs-dri2.patch      |  0
 .../0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch      |  0
 .../0003-Remove-check-for-useSIGIO-option.patch                |  0
 package/x11r7/xserver_xorg-server/Config.in                    |  4 ++--
 package/x11r7/xserver_xorg-server/xserver_xorg-server.hash     | 10 +++++-----
 5 files changed, 7 insertions(+), 7 deletions(-)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0001-modesettings-needs-dri2.patch (100%)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch (100%)
 rename package/x11r7/xserver_xorg-server/{1.19.4 => 1.19.5}/0003-Remove-check-for-useSIGIO-option.patch (100%)

package/x11r7/xserver_xorg-server/1.19.5/0001-modesettings-needs-dri2.patch renamed from package/x11r7/xserver_xorg-server/1.19.4/0001-modesettings-needs-dri2.patch +0 -0

similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0001-modesettings-needs-dri2.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0001-modesettings-needs-dri2.patch

package/x11r7/xserver_xorg-server/1.19.5/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch renamed from package/x11r7/xserver_xorg-server/1.19.4/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch +0 -0

similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0002-configure.ac-Fix-check-for-CLOCK_MONOTONIC.patch

package/x11r7/xserver_xorg-server/1.19.5/0003-Remove-check-for-useSIGIO-option.patch renamed from package/x11r7/xserver_xorg-server/1.19.4/0003-Remove-check-for-useSIGIO-option.patch +0 -0

similarity index 100%
rename from package/x11r7/xserver_xorg-server/1.19.4/0003-Remove-check-for-useSIGIO-option.patch
rename to package/x11r7/xserver_xorg-server/1.19.5/0003-Remove-check-for-useSIGIO-option.patch

package/x11r7/xserver_xorg-server/Config.in +2 -2

index 71164b3794..08dea0a5ef 100644
@@ -79,7 +79,7 @@ choice
 	bool "X Window System server version"
 
 config BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
-	bool "1.19.3"
+	bool "1.19.5"
 	select BR2_PACKAGE_XSERVER_XORG_SERVER_VIDEODRV_ABI_23
 	select BR2_PACKAGE_XLIB_LIBXFONT2
 	select BR2_PACKAGE_XPROTO_PRESENTPROTO

@@ -99,7 +99,7 @@ endchoice
 
 config BR2_PACKAGE_XSERVER_XORG_SERVER_VERSION
 	string
-	default "1.19.4" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
+	default "1.19.5" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_19
 	default "1.17.4" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_17
 	default "1.14.7" if BR2_PACKAGE_XSERVER_XORG_SERVER_V_1_14

package/x11r7/xserver_xorg-server/xserver_xorg-server.hash +5 -5

index d0acc24102..c0feb985d2 100644
@@ -3,8 +3,8 @@ sha1   7a95765e56b124758fcd7b609589e65b8870880b                                x
 sha256 fcf66fa6ad86227613d2d3e8ae13ded297e2a1e947e9060a083eaf80d323451f        xorg-server-1.14.7.tar.bz2
 # From https://lists.x.org/archives/xorg-announce/2015-October/002650.html
 sha256 0c4b45c116a812a996eb432d8508cf26c2ec8c3916ff2a50781796882f8d6457        xorg-server-1.17.4.tar.bz2
-# From https://lists.x.org/archives/xorg-announce/2017-October/002808.html
-md5 28cb6d773bfcdfd43500dd64527d2ab0 xorg-server-1.19.4.tar.bz2
-sha1 7a47d5f927ea69681e279c6e5f5e8ff3a21c7152 xorg-server-1.19.4.tar.bz2
-sha256 aa758acea91deaf1f95069ddc5ea3818e13675fb14fef40ad1b3d0b2bf03c9a8 xorg-server-1.19.4.tar.bz2
-sha512 ff80934e42a7dd2d437e947fe02c74c3b25bdbb3002b7005191d52272d5eae8cb3a83377fa32f40000011be88405830e796f6bd3b914bd7fc163ea8ece76226b xorg-server-1.19.4.tar.bz2
+# From https://lists.x.org/archives/xorg-announce/2017-October/002814.html
+md5 4ac6feeae6790436ce9de879ca9a3bf8  xorg-server-1.19.5.tar.bz2
+sha1 307d3405f709f7e41966c850b37deefe7f83eb9b  xorg-server-1.19.5.tar.bz2
+sha256 18fffa8eb93d06d2800d06321fc0df4d357684d8d714315a66d8dfa7df251447  xorg-server-1.19.5.tar.bz2
+sha512 928dea5850b98cd815004cfa133eca23cfa9521920c934c68a92787f2cae13cca1534eee772a4fb74b8ae8cb92662b5d68b95b834c8aa8ec57cd57cb4e5dd45c  xorg-server-1.19.5.tar.bz2

Signature · 1 line

2.11.0

Peter Korsgaard

2017-10-15 21:00 UTC #4 lore raw

PATCH 4/4 package/x11r7/xserver_xorg-server: security bump version to 1.19.5

Quoted 8 lines

Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Bernd" == Bernd Kuhls <[email protected]> writes:
Fixes
xfixes: unvalidated lengths (CVE-2017-12183)
Xi: fix wrong extra length check in ProcXIChangeHierarchy
(CVE-2017-12178)

Quoted 6 lines

dbe: Unvalidated variable-length request in ProcDbeGetVisualInfo
(CVE-2017-12177)
Unvalidated extra length in ProcEstablishConnection (CVE-2017-12176)
Signed-off-by Bernd Kuhls <[email protected]>

Committed to 2017.02.x, thanks.

Signature · 1 line

Bye, Peter Korsgaard

Thomas Petazzoni

2017-10-15 13:57 UTC #5 lore raw

PATCH 1/4 package/x11r7/xlib_libXfont2: bump version to 2.0.2

In reply to Bernd Kuhls

Hello,

Quoted 11 lines · Bernd Kuhls

Removed patches applied upstream, added all upstream hashes.

Signed-off-by Bernd Kuhls <[email protected]>

---
 ...nd-of-string-in-PatternMatch-CVE-2017-137.patch | 34 --------------
 ...rties-Check-string-boundaries-CVE-2017-13.patch | 52 ----------------------
 package/x11r7/xlib_libXfont2/xlib_libXfont2.hash   |  7 ++-
 package/x11r7/xlib_libXfont2/xlib_libXfont2.mk     |  2 +-
 4 files changed, 6 insertions(+), 89 deletions(-)
 delete mode 100644 package/x11r7/xlib_libXfont2/0001-Check-for-end-of-string-in-PatternMatch-CVE-2017-137.patch
 delete mode 100644 package/x11r7/xlib_libXfont2/0002-pcfGetProperties-Check-string-boundaries-CVE-2017-13.patch

All four patches applied. Thanks!

Thomas

Signature · 3 lines

Thomas Petazzoni, CTO, Free Electrons
Embedded Linux, Kernel and Android engineering
http://free-electrons.com